{"id":3864,"date":"2024-08-22T20:38:59","date_gmt":"2024-08-22T20:38:59","guid":{"rendered":"https:\/\/www.xitens.nl\/?page_id=3864"},"modified":"2025-11-26T05:45:27","modified_gmt":"2025-11-26T05:45:27","slug":"data-processing-agreement","status":"publish","type":"page","link":"https:\/\/www.xitens.nl\/en\/verwerkersovereenkomst\/","title":{"rendered":"Data Processing Agreement"},"content":{"rendered":"
\n
\n
\n

Data Processing Agreement<\/h1>\nXITENS<\/span>\n
\n
    \n \t
  1. Home<\/a><\/li>\n \t
  2. data processing agreement<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/section>
    \n
    \n
    \n

    This Processing Agreement applies to all forms of processing of personal data XITENS<\/a>, registered with the Chamber of Commerce under number 83553983, (hereinafter: Controller) has it carried out by a party it engages for this purpose (hereinafter: Processor) on the basis of the agreement concluded between the parties (hereinafter: the General terms and conditions<\/a><\/p>\n\n

    Article 1. Purposes of processing<\/h4>\n
      \n \t
    1. 1.1. The Processor undertakes to process personal data on behalf of the Controller under the conditions of this Processing Agreement. Processing will only take place in the context of processing orders and payments for products or services of the Controller, management of the accounting and financial administration of the Controller, management of the personnel administration of the Controller, maintaining telephone contact with customers of the Controller for handling complaints and providing service, sending newsletters on behalf of the Controller, management of the customer administration of the Controller, plus those purposes that are reasonably related thereto or those with further consent is determined.<\/li>\n \t
    2. 1.2. The personal data processed by the Processor in the context of the activities referred to in the previous paragraph and the categories of data subjects from whom they originate are included in Appendix 1. The Processor will not process the personal data for any purpose other than as determined by the Controller. The Controller will inform the Processor of the processing purposes insofar as these have not already been mentioned in this Processing Agreement. However, the processor may use the personal data for quality purposes, such as surveying data subjects or conducting scientific or statistical research into the quality of its services.<\/li>\n \t
    3. 1.3. The personal data to be processed on behalf of the Controller remains the property of the Controller and\/or the relevant data subjects.<\/li>\n<\/ol>\n

      Article 2. Obligations of Processor<\/h4>\n
        \n \t
      1. 2.1. With regard to the processing referred to in Article 1, the Processor will ensure compliance with the applicable laws and regulations, including in any case the laws and regulations in the field of the protection of personal data, such as the General Data Protection Regulation.<\/li>\n \t
      2. 2.2. The Processor will inform the Controller, at its first request, about the measures it has taken regarding its obligations under this Processing Agreement.<\/li>\n \t
      3. 2.3. The obligations of the Processor arising from this Processing Agreement also apply to those who process personal data under the authority of the Processor, including but not limited to employees, in the broadest sense of the word.<\/li>\n \t
      4. 2.4. The Processor will immediately inform the Controller if, in its opinion, an instruction from the Controller is contrary to the legislation referred to in paragraph 1.<\/li>\n \t
      5. 2.5. The Processor will, to the extent within its power, provide assistance to the Controller in carrying out data protection impact assessments (PIAs).<\/li>\n \t
      6. 2.6. In accordance with Article 30 GDPR, the Processor will keep a register of all categories of processing activities that it carries out on behalf of the Controller under this Processing Agreement. The Processor will provide the Controller with access to this upon request.<\/li>\n<\/ol>\n

        Article 3. Transfer of personal data<\/h4>\n
          \n \t
        1. 3.1. The processor may process the personal data in countries within the European Union. Transfer to countries outside the European Union is prohibited.<\/li>\n<\/ol>\n

          Article 4. Division of responsibility<\/h4>\n
            \n \t
          1. 4.1. The permitted processing will be carried out by employees of the Processor within an automated environment.<\/li>\n \t
          2. 4.2. The Processor is solely responsible for the processing of the personal data under this Processing Agreement, in accordance with the instructions of the Controller and under the explicit (ultimate) responsibility of the Controller. The Processor is expressly not responsible for other processing of personal data, including, but not limited to, the collection of personal data by the Controller, processing for purposes that have not been reported to the Processor by the Controller, processing by third parties and\/or for other purposes.<\/li>\n \t
          3. 4.3. The controller guarantees that the content, use and instructions for processing the personal data as referred to in this processing agreement are not unlawful and do not infringe any rights of third parties.<\/li>\n<\/ol>\n

            Article 5. Engaging third parties or subcontractors<\/h4>\n
              \n \t
            1. 5.1. In the context of this processing agreement, the processor may not use a third party without the prior written permission of the Controller, which permission may be subject to further conditions.<\/li>\n \t
            2. 5.2. In any case, the Processor ensures that these third parties undertake at least the same obligations in writing as agreed between the Controller and the Processor. The controller has the right to inspect any agreements that may be involved.<\/li>\n \t
            3. 5.3. The processor guarantees correct compliance with the obligations under this Processing Agreement by these third parties and is liable for all damage in the event of errors by these third parties as if it had committed the error(s) itself.<\/li>\n<\/ol>\n

              Article 6. Security<\/h4>\n
                \n \t
              1. 6.1. The processor will make every effort to take sufficient technical and organizational measures with regard to the processing of personal data to be carried out, against loss or against any form of unlawful processing (such as unauthorized access, impairment, modification or provision of the personal data).<\/li>\n \t
              2. 6.2. The processor does not guarantee that the security is effective under all circumstances. If an explicitly described security is missing in the Processing Agreement, the Processor will make every effort to ensure that the security meets a level that is not unreasonable, taking into account the state of the art, the sensitivity of the personal data and the costs associated with providing security.<\/li>\n \t
              3. 6.3. The Controller only makes personal data available to the Processor for processing if it has ensured that the required security measures have been taken. The Controller is responsible for compliance with the measures agreed upon by the Parties.<\/li>\n<\/ol>\n

                Article 7. Notification Obligation<\/h4>\n
                  \n \t
                1. 7.1. The controller is at all times responsible for reporting a security breach and\/or data breach (which is understood to mean: a breach of the security of personal data that leads to a risk of adverse consequences, or has adverse consequences for the protection of personal data) to the supervisory authority and\/or data subjects. To enable the Controller to comply with this legal obligation, the Processor will immediately inform the Controller of the security breach and\/or data breach.<\/li>\n \t
                2. 7.2. A report must always be made, but only if the event has actually occurred.<\/li>\n \t
                3. 7.3. The reporting obligation in any case includes reporting the fact that there has been a leak. In addition, the reporting obligation includes: the nature of the personal data breach, where possible stating the categories of data subjects and personal data involved and, approximately, the number of data subjects and personal data registers involved; the name and contact details of the data protection officer or other contact point where further information can be obtained; the likely consequences of the personal data breach; the measures proposed or taken by the Processor to address the personal data breach, including, where appropriate, measures to limit any adverse consequences thereof.<\/li>\n \t
                4. 7.4. In accordance with Article 33(5) GDPR, the Processor will document all data breaches, including the facts surrounding the personal data breach, its consequences and the corrective measures taken. The Processor will provide the Controller with access to this upon request.<\/li>\n<\/ol>\n

                  Article 8. Handling requests from data subjects<\/h4>\n
                    \n \t
                  1. 8.1. In the event that a data subject submits a request to the Processor to exercise his\/her legal rights (Article 15-22 GDPR), the Processor will forward the request to the Controller, and the Controller will further process the request. The processor may inform the data subject of this.<\/li>\n<\/ol>\n

                    Article 9. Secrecy and confidentiality<\/h4>\n
                      \n \t
                    1. 9.1. All personal data that the Processor receives from the Controller and\/or collects itself in the context of this Processing Agreement is subject to an obligation of confidentiality towards third parties. The processor will not use this information for a purpose other than that for which it obtained it, even if it has been put in such a form that it cannot be traced back to the data subjects.<\/li>\n \t
                    2. 9.2. This obligation of confidentiality does not apply to the extent that the Controller has given explicit permission to provide the information to third parties, if the provision of the information to third parties is logically necessary given the nature of the assignment given and the execution of this Processing Agreement, or if there is a legal obligation to provide the information to a third party.<\/li>\n<\/ol>\n

                      Article 10. Audit<\/h4>\n
                        \n \t
                      1. 10.1. The controller has the right to have audits carried out by an independent third party bound by confidentiality to verify compliance with the security requirements, and everything directly related to this.<\/li>\n \t
                      2. 10.2. This audit may take place if there is a specific suspicion of misuse of personal data.<\/li>\n \t
                      3. 10.3. The processor will cooperate with the audit and make all information reasonably relevant to the audit, including supporting data such as system logs, and employees available as timely as possible.<\/li>\n \t
                      4. 10.4. The findings resulting from the audit carried out will be implemented by the Processor as soon as possible.<\/li>\n \t
                      5. 10.5. The costs of the audit are borne by the Controller.<\/li>\n<\/ol>\n

                        Article 11. Liability and penalty provisions<\/h4>\n
                          \n \t
                        1. 11.1. The Processor's liability for damage resulting from an attributable shortcoming in the fulfillment of the Processing Agreement, or from tort or otherwise, is excluded. To the extent that the aforementioned liability cannot be excluded, it is limited per event (a series of consecutive events counts as one event) to compensation for direct damage, up to a maximum of the amount of the compensation received by the Processor for the work under this Processing Agreement for the month prior to the event causing the damage. The Processor's liability for direct damage will never amount to more than \u20ac 100,000.00 in total.<\/li>\n \t
                        2. 11.2. Direct damage is exclusively understood to mean all damage consisting of: damage directly caused to material property (\u201cproperty damage\u201d); reasonable and demonstrable costs to urge the Processor to properly comply with the Processing Agreement (again); reasonable costs to determine the cause and extent of the damage insofar as it relates to the direct damage as referred to here; and reasonable and demonstrable costs incurred by the Controller to prevent or limit the direct damage as referred to in this article.<\/li>\n \t
                        3. 11.3. The Processor's liability for indirect damage is excluded. Indirect damage is understood to mean all damage that is not direct damage and therefore in any case, but not limited to, consequential damage, lost profits, lost savings, reduced goodwill, damage due to business stagnation, damage due to failure to determine marketing objectives, damage related to the use of data or data files prescribed by the Controller, or loss, mutilation or destruction of data or data files.<\/li>\n \t
                        4. 11.4. The exclusions and limitations referred to in this article will lapse if and insofar as the damage is the result of intent or deliberate recklessness on the part of the Processor or its management.<\/li>\n \t
                        5. 11.5. Unless compliance by the Processor is permanently impossible, the Processor's liability due to attributable shortcomings in the performance of the Agreement only arises if the Controller immediately gives the Processor notice of default in writing, setting a reasonable period for the correction of the shortcoming, and the Processor continues to attributably fail to fulfill its obligations even after that period. The notice of default must contain a description of the shortcoming that is as complete and detailed as possible, so that the Processor is given the opportunity to respond adequately.<\/li>\n \t
                        6. 11.6. Any claim for compensation by the Controller against the Processor that has not been specified and explicitly reported will lapse after twelve (12) months after the claim arose.<\/li>\n \t
                        7. 11.7. During the Processing Agreement, the Processor will have and will continue to be adequately insured for liability in accordance with this article. The insurance conditions for this can be viewed on request.<\/li>\n \t
                        8. 11.8. In the event of a violation of the Processing Agreement, the Processor will forfeit an immediately payable fine of \u20ac 100,000.00 per violation and \u20ac 10,000.00 per day that the violation continues to the Controller.<\/li>\n<\/ol>\n

                          Article 12. Duration and termination<\/h4>\n
                            \n \t
                          1. 12.1. This Processing Agreement is concluded by signature of the Parties and on the date of the last signature.<\/li>\n \t
                          2. 12.2. This Processing Agreement has been entered into for the duration as determined in the General Terms and Conditions between the Parties and, failing that, in any case for the duration of the collaboration.<\/li>\n \t
                          3. 12.3. As soon as the Processing Agreement has been terminated, for any reason and in any way whatsoever, the Processor will - at the option of the Controller - return all personal data it has in its original or copy form to the Controller, and\/or delete and\/or destroy these original personal data and any copies thereof.<\/li>\n \t
                          4. 12.4. The Controller is entitled to revise this Processing Agreement from time to time. It will notify the Processor of the changes at least three months in advance. The processor may cancel at the end of these three months if it cannot agree to the changes.<\/li>\n<\/ol>\n

                            Article 13. Applicable law and dispute resolution<\/h4>\n
                              \n \t
                            1. 13.1. The Processing Agreement and its implementation are governed by Dutch law.<\/li>\n \t
                            2. 13.1. The Processing Agreement and its implementation are governed by Dutch law.\n13.2. All disputes that may arise between the Parties in connection with the Processing Agreement will be submitted to the competent court for the district in which the Controller is located.<\/li>\n<\/ol>\n

                              Appendix 1: Specification of personal data and data subjects<\/h4>\n
                                \n \t
                              1. Personal data Processor will, in the context of Article 1.1 of the Processing Agreement, process the following (special) personal data on behalf of the Controller:<\/li>\n \t
                              2. <\/li>\n \t
                              3. <\/li>\n \t
                              4. <\/li>\n<\/ol>\n